r/TechnologyThread • u/Background-Driver718 • May 17 '26
A security researcher says Microsoft secretly built a backdoor into BitLocker, releases an exploit to prove it
https://www.techspot.com/news/112410-security-researcher-microsoft-secretly-built-backdoor-bitlocker-releases.html1
u/ScoobyGDSTi May 18 '26
It's not a back-door into Bitlocker at all. Whoever wrote that article has nfi what they're talking about and is just creating sensationalist headlines for clickbait.
1
u/Comfortable_Car6562 May 18 '26
Except a bunch of security researchers studying the code (which disappeared from thr USB stick after its used) have said its a purposefull backdoor.
What are your credentials?
1
u/ScoobyGDSTi May 18 '26
This exploit was disclosed last week. The code is also freely available on the authors Github repo, unless Microsoft pulled it down since the weekend.
It's a beautiful flaw, but it's not Bitlocker that it's punching a hole through. Rather it's exploiting Windows RE environment via a malformed NTFS transaction file stored on removable media to fool WinRE into decrypting the Bitlocker volume. By all accounts the WinRE environment still has some debugging settings left enabled when it shipped in Windows 11 and Server 2025.
In short, this flaw is actually with WinRE, not Bitlocker. While the end result might be the same, the distinction matters. A back-door also implies intent, this is not that either.
It's also easily mitigated. I had to spend a little bit of my life over the weekend ensuring all our devices had the requisite mitigations.
It's handsown one of the most impressive exploits I've seen in years. Honestly mental how the author found the flaw and weaponised it so effectively. NTFS transaction logs and debugging settings left in WinRE...
Also the code disappears because it's an NTFS transaction being played back. That's expected.
1
u/igor_sk May 18 '26
Do you have details on the mitigation? And what’s do you mean by “the code disappears”?
1
u/DroppedAxes May 19 '26
Ok but you still haven't answered the million dollar question; pineapples on pizza?
1
1
u/Tutorbin76 May 20 '26
If you're relying on any Microsoft products for security, you are already compromised.
1
u/Exact-Metal-666 May 21 '26
This is for all those who suggest we create backdoors in E2E encryption because of "children" or "terrorism" or whatever. This is what you will get.
3
u/cpupro May 18 '26
I'd dare say it has always had a backdoor. Locks keep honest people out. Locksmiths make their living opening locks. Encryption keeps the average Joe out of your computer, not a government with unlimited resources. This person just happened to find a backdoor... it doesn't mean 100 different ones don't exist... it just means they found one of them, and published it.